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DETAILED ACTION 

1. Claims 1-39 are pending in the application. 

2. Claims 1-39 stand being rejected. 

EXAMINER'S AMENDMENT 

3. An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
Joel D. Youngs on November 14, 2004. 

The application has been amended as follows: 
Claim 1 (amended) A system for providing a firewall to a communication device, said system 
comprising: 

a first device comprising a hardware implemented firewall, said first device 
coupled to a host device that is coupled to said communication device for establishing a 
connection to a network; 

logic residing in said system other than on said communication device, said logic 
allowing said communication device to establish a connection to the network, wherein 
said logic further allows said host device to connect to said network using said 
communication device, wherein neither said host device nor said communication device 
has a firewall capability that is required by the network to connect to the network; and 
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said logic on said system configured to cause data transferred by the 
communication device to be processed by said firewall on said first device. 

Response to Arguments 

4. Applicant's arguments with respect to claims 1-39 have been considered but are moot in view 
of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another who 
has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title before the invention 
thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 
(AIP A) and the Intellectual Property and High Technology Technical Amendments Act of 2002 
do not apply when the reference is a U.S. patent resulting directly or indirectly from an 
international application filed before November 29, 2000. Therefore, the prior art date of the 
reference is determined under 35 U.S.C. 102(e) prior to the amendment by the AIPA (pre-AIPA 
35 U.S.C. 102(e)). 

5. Claims 1, 4-6, 10, 12, 13, 15-20, 22-24, 32, 33, 36 and 39 rejected under 35 U.S.C. 102(e) 
as being anticipated by Gonda et al U.S. Patent No. 6,662,221 Bl. 

As to claims 1, 22 and 36, Gonda et al discloses a system for providing a firewall to a 
communication device, the system comprising: 
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a first device comprising a hardware implemented firewall, the first device 
coupled to a host device that is coupled to the communication device for 
establishing a connection to a network [column 4, lines 10-47]; 

logic residing in the system other than on the communication device, the 
logic allowing the communication device to establish a connection to the network, 
wherein the logic further allows the host device to connect to the network using 
the communication device, wherein neither the host device nor the 
communication device has a firewall capability that is required by the network to 
connect to the network [column 4, lines 10-47]; and 

the logic on the system configured to cause data transferred by the 
communication device to be processed by the firewall on the first device [column 
5, lines 7-28], 

As to claim 4, Gonda et al discloses a server for providing policies to be used by the 
firewall and that the first device is operable to access the server to receive the policies [column 5, 
lines 7-28]. 

As to claim 5, Gonda et al discloses that the system further comprises a plurality of nodes 
having a hardware-implemented firewall [column 4, lines 10-47]. Gonda et al discloses that the 
server is further operable to transfer the policies to the plurality of nodes and that the system 
comprises a centrally managed network having nodes with hardware implemented firewalls 
[column 6, lines 40-55]. 
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As to claim 6, Gonda et al discloses that the logic to allow the system to establish a 
connection to the network comprises hardware implemented token [column 7 line 57 to column 8 
line 14]. 

As to claim 10, Gonda et al discloses logic for preventing login of the host device unless 
the first device is coupled to the host device [column 8, lines 27-48]. 

As to claim 12, Gonda et al discloses that the first device is physically coupled to the 
communication device [column 4, lines 10-47]. Gonda et al discloses that the data transferred by 
the communication device to the network is processed by the firewall before it is transferred into 
the network and the data transferred from the network to the communication device passes 
through the firewall before it reaches the host device [column 5, lines 7-28]. 

As to claim 13, Gonda et al discloses that the physical connection is of the same medium 
as the network connection [column 4, lines 10-47]. 

As to claim 15, Gonda et al discloses that the system further comprises a software driver 
in the host device and that the driver is operable to pass data that is received by the 
communication device to the first device to be processed by the firewall [column 4, lines 10-47]. 

As to claim 16, Gonda et al discloses that the software driver is further operable to pass 
data which is to be transferred by the communication device over the network to the first device 
to be processed by the firewall, as discussed above. 

As to claim 17, Gonda et al discloses a software component installed above a driver for 
the communication device, the software component operable to route data for the communication 
device to the first device [column 4, lines 10-47]. 
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As to claim 18, Newton's defines a shim as a piece of software. Microsoft defines a 
miniport driver as a kernel-mode driver that is specific to a device. As to the limitation "said 
software component is a shim", TCP is the software component would have been the shim. The 
miniport driver would have been the driver for the NIC. The examiner asserts that TCP operates 
within an operating system. The examiner further asserts that an operating system resides above 
any drivers. 

As to claim 19, Gonda et al discloses a software component installed below a driver for 
the communication device and that the software component is operable to route data for the 
communication device to the first device [column 5, lines 7-28]. 

As to claim 20, Gonda et al discloses transfer security logic residing on the first device. 
Gonda et al discloses that the transfer security logic is for securely transferring data between the 
first device and a server in the network [column 5, lines 7-28]. 

As to claims 23 and 33, Gonda et al discloses that the host device routes the data to the 
firewall device is to be processed by the hardware-implemented firewall, as discussed above. 
Gonda et al discloses that the routing takes place at a physical layer in the data stack [column 8, 
lines 27-47]. 

As to claim 24, Gonda et al discloses sending policies to the firewall device and that the 
operation of the hardware implemented firewall is modified [column 5, lines 7-28]. 

As to claim 32, Gonda et al discloses transferring data to be transferred over the network 
by the communication interface device to the firewall device, as discussed above. Gonda et al 
discloses processing the data with the hardware-implemented firewall, as discussed above. 
Gonda et al discloses that the data is processed by the hardware-implemented firewall before it is 
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transferred over the network connection established via the communication interface device, as 
discussed above. 

As to claim 39, Gonda et al discloses that the hardware-implemented firewall is dedicated 
to the host device [column 5, lines 7-28]. 

Claim Rejections - 35 USC §103 

The following is a quotation of 35 U.S.C 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. Claims 2, 8, 9, 11, 21, 25 and 34 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gonda et al et al U.S. Patent No. 6,662,221 Bl as applied to claims 1 and 
22 above, and further in view of Gleichauf et al U.S. Patent No. 6,324,656 Bl. 

As to claims 2, 11 and 25, Gonda et al does not teach logic for checking integrity of 
software components in the system. 

Gleichauf teaches logic for checking integrity of software components in the system. 
Gleichauf teaches that network devices are scanned for the potential vulnerabilities inherent to 
the services and the operating system of each device [column 5, lines 41-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Gonda et al so that the computer implemented 
firewall would have performed a scan for the potential vulnerabilities to the services and the 
operating system for each device. 
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It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Gleichauf is that each 
device connected to the network can identified and the appropriate vulnerabilities can be 
assessed [column 2, lines 51-54]. 

As to claim 8, Gonda et al does not teach an alert log for logging possible breaches 
detected by the system. 

Gleichauf teaches an alert log for logging possible breaches detected by the system. 
Gleichauf teaches database 26 that can include potential vulnerabilities identified by the NVA 
engine 20 [column 4 5 lines 47-49]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Gonda et al so that the computer implemented 
firewall would have performed a scan for the potential vulnerabilities and stored the potential 
vulnerabilities in a database. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Gleichauf because it 
confirms identified potential vulnerabilities [column 2, lines 55-56]. 

As to claim 9, Gleichauf teaches a configuration integrity checker (i.e. NVA engine 20) 
for checking integrity of software components (i.e. operating system) in the system, wherein the 
possible breach is detected by the configuration integrity checker [Gleichauf column 5, lines 41- 
45]. 

As to claims 21 and 34, Gonda et al teaches server for providing policies to be used by 
the firewall, as discussed above. 
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Gonda et al does not teach a configuration integrity checker for checking integrity of 
software components in the system. Gonda et al does not teach an alert log for logging possible 
security breaches detected by the system. 

Gleichauf teaches a configuration integrity checker for checking integrity of software 
components in the system. Gleichauf combination teaches a configuration integrity checker (i.e. 
NVA engine 20) for checking integrity of software components (i.e. operating system) in the 
system. Gleichauf teaches that the possible breach was detected by the configuration integrity 
checker [column 5, lines 41-45]. Gleichauf teaches an alert log for logging possible breaches 
detected by the system. Gleichauf teaches database 26 that can include potential vulnerabilities 
identified by the NVA engine 20 [column 4, lines 47-49], Gleichauf teaches an alert log for 
logging possible security breaches detected by the system. Gleichauf teaches database 26 that 
can include potential vulnerabilities identified by the NVA engine 20 [column 4, lines 47-49]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Gonda et al so that an NVA engine would have 
been included on the computer that the firewall resides. The NVA would have scanned the 
software components of the devices on the network and recorded a log for possible security 
breaches. The server of Gonda et al would have provided the policies for the NVA engine. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Gleichauf is that each 
device connected to the network can identified and the appropriate vulnerabilities can be 
assessed [column 2, lines 51-54]. 
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7. Claims 3 and 7 are rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et 
al et al U.S. Patent No. 6,662,221 Bl as applied to claim 1 above, and further in view of 
Servi U.S. Patent No. 5,278,904. 

As to claim 7, Gonda et al teaches that the second device is coupled to the first device, as 
discussed above, 

Gonda et al does not teach a second device having stored thereon data needed to establish 
the connection to the network. Gonda et al does not teach logic to allow the system to establish 
the connection and is operable to access the data to assure the first device must be in the system 
to establish the connection to the network via the communication device 

Servi teaches a stored password on a requesting node to access protected resources on a 
server node [column 1, lines 55-63]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was 'made to have modified Gonda et al so that any of the firewall devices 
would have been authenticated by a stored password to receive policies from the security policy 
server. The password would have been stored data used to establish the connection to the 
network. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al is that this provides a method for reliable 
identification of a device attempting access to protected resources by a remote verifier using 
reduced communications [column 1, lines 45-47]. 
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8. Claim 14 is rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et al et al 
U.S. Patent No. 6,662,221 Bl as applied to claim 1 above, and further in view of Dempsey et 
al U.S. Patent No. 5,826,048. 

As to claim 14, Gonda et al does not teach that the physical connection comprises an 
MPCI (Mini Peripheral Component Interconnect) adapter to couple the first device to the 
communication device. 

Dempsey teaches a MPCI interface for connecting a PCI bus to one or more external 
devices [column 2, lines 43-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Gonda et al so that the MPCI interface would 
have connected the firewall to the NIC. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Dempsey because it 
reduces the number of signals required in implementing a PCI compliant interface by 
multiplexing and subsequently de-multiplexing signals. It also can be used to interface non-PCI 
devices and bus, and can be adapted or modified to reduce the number of pins/signals associated 
with these devices and buses [column 3, lines 51-58]. 

9. Claim 26 is rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et al et al 
U.S. Patent No. 6,662,221 Bl and Gleichauf et al U.S. Patent No. 6,324,656 Bl as applied to 
claim 22 above, and further in view of Watson et al U.S. Patent No. 5,475,839. 



Application/Control Number: 10/090,543 Page 12 

Art Unit: 2131 

As to claim 26, the Gonda-Gleichauf combination does not teach that the configuration 
integrity check is performed before the network connection is allowed and the connection is 
allowed only if the configuration integrity check passes. 

Watson teaches that tests are performed prior to or during the boot operation in order to 
determine whether selected programs and/or data files have been corrupted [column 3, lines 60- 
63]. The examiner asserts that the boot operation takes place before a network connection takes 
place. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified the Gonda-Gleichauf combination so that tests are 
performed on the host device prior to or during the boot operation in order to determine if any 
data files have been corrupted. If anything were corrupted the boot process would have been 
interrupted. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the Gonda-Gleichauf combination by the teaching of 
Watson because it allows the user to boot the system from a known, uncorrupted set of files in 
the event the system is corrupted [column 3 line 67 to column 4 line 3]. 

10. Claims 27 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gonda et al et al U.S. Patent No. 6,662,221 Bl and Gleichauf et al U.S. Patent No. 6,324,656 
Bl as applied to claim 22 above, and further in view of Fischer U.S. Patent No. 5,475,826. 

As to claim 27, the Gonda-Gleichauf combination does not teach that performing a hash 
on the software component to produce a hash value and comparing the hash value with a stored 
hash value to perform the configuration integrity check. 
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Fischer teaches it is well known that file integrity is protected by taking a one-way hash 
(e.g., by using MD5 or the secure hash algorithm SHA) over the contents of the file. By 
implementing and checking a currently computed hash value, with a previously stored hash 
value, correct file integrity assures the threat of malicious tampering (or even accidental 
external modification) can be detected-thereby improving the reliability and security of 
ultimate results. Assuming it is stored in a way that preserves its own integrity, the file hash 
can be used to insure that the entire file has not been damaged or deliberately tampered [column 
1, lines 37-47]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified the Gonda-Gleichauf combination so that a hash 
on the software component is done to produce a hash value and compared with a stored hash 
value on the firewall to perform the configuration integrity check. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the Gonda-Gleichauf combination by the teaching of 
Fischer because for massive re-computation for each file alteration, long periods in which the file 
is in jeopardy of being considered "invalid" if the application or system is abruptly terminated, 
additional storage space for a hash (or MAC) for each record, and the ability of an adversary to 
substitute stale records because the integrity of the entire file, and the inter-relationship of all 
records is maintained encapsulated in a single file HASH value which changes as each file 
update is performed [column 3, lines 48-57]. 

As to claim 28, the Gonda-Gleichauf-Fischer combination that the stored hash value 
resides on the firewall device, as discussed above. 
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11. Claims 29, 30 and 35 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Gonda et al et al U.S. Patent No. 6,662,221 Bl and Gleichauf et al U.S. Patent No. 6,324,656 
Bl as applied to claim 22 above, and further in view of Daniel et al U.S. Patent No. 
4,823,345. 

As to claims 29 and 35, the Gonda-Gleichauf combination does not teach sending an alert 
if the configuration integrity check fails. 

Daniel teaches a generic alert code generation and identification method and apparatus 
that can identify a particular generic alert [column 2, lines 15-20]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was to have modified the Gonda-Gleichauf combination so that an alert is 
generated if the integrity check fails. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the Gonda-Gleichauf combination by the teaching of 
Daniel et al because an administrator or user would want an alert to know when something is 
corrupt in a network device. 

As to claim 30, the Gonda-Gleichauf-Daniel combination teaches storing an alert if the 
configuration integrity check fails [Daniel et al column 3, lines 44-59]. 

12. Claims 31 is rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et al et 
al U.S. Patent No. 6,662,221 Bl and Gleichauf et al U.S. Patent No. 6,324,656 Bl as applied 
to claim 25 above, and further in view of Uceda-Sosa et al U.S. Patent No. 6,496,840 Bl. 

As to claim 31, the Gonda-Gleichauf combination teaches that host device treats the 
communication interface device as the firewall device and vice versa, as discussed above. The 
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Gonda-Gleichauf combination teaches that the communication interface device transferring data 
received from the network in to the firewall device, wherein the firewall device processes the 
data with the hardware implemented firewall, as discussed above. 

The Gonda-Gleichauf combination does not teach swapping resource spaces in the host 
device that are reserved for the communication interface device and the firewall device. 

Uceda-Sosa teaches executing a current modification request on one or more resources of 
a backup resource group; and atomically swapping the modified backup resource group and a 
current resource group, such that the modified backup resource- group becomes the current 
resource group [column 1, lines 34-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was to have modified the Gonda-Gleichauf combination so that the resources 
would have been swapped in the host device that was reserved for the communication device and 
the firewall device so that the NIC would have been the firewall. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the Gonda-Gleichauf combination by the teaching of 
Uceda-Sosa because it provides a platform independent, application-level technique that 
provides all-or-nothing semantics at the atomicity level of the underlying operating system, by 
providing a fixed-size naming scheme and a technique that determines which version of the 
resource group is the current version [column 5, lines 8-18]. 

13. Claims 37 is rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et al et 
al U.S. Patent No. 6,662,221 Bl as applied to claim 36 above, and further in view of Fischer 
U.S. Patent No. 5,475,826. 
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As to claim 37, Gonda et al does not teach logic for performing a configuration integrity 
check of software component. Gonda et al does not teach that the logic is operable to produce a 
numeric value that results from the check. Gonda et al does not teach a stored value for each 
software component to be checked for integrity. Gonda et al does not teach logic to compare the 
produced value with the stored value. 

Fischer teaches it is well known that file integrity is protected by taking a one-way hash 
(e.g., by using MD5 or the secure hash algorithm SHA) over the contents of the file. By 
implementing and checking a currently computed hash value, with a previously stored hash 
value, correct file integrity assures the threat of malicious tampering (or even accidental external 
modification) can be detected-thereby improving the reliability and security of ultimate results. 
Assuming it is stored in a way that preserves its own integrity, the file hash can be used to insure 
that the entire file has not been damaged or deliberately tampered [column 1, lines 37-47]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified Gonda et al so that a hash on the software 
component is done to produce a hash value and compared with a stored hash value on the 
firewall to perform the configuration integrity check. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Fischer because massive re- 
computation for each file alteration, long periods in which the file is in jeopardy of being 
considered "invalid" if the application or system is abruptly terminated, additional storage space 
for a hash (or MAC) for each record, and the ability of an adversary to substitute stale records 
because the integrity of the entire file, and the inter-relationship of all records is maintained 
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encapsulated in a single file HASH value which changes as each file update is performed 
[column 3, lines 48-57]. 

14, Claim 38 is rejected under 35 U.S.C. 103(a) as being unpatentable over Gonda et al et 
al U.S. Patent No. 6,662,221 Bl as applied to claim 36 above, and further in view of Servi 
U.S. Patent No. 5,278,904. 

As to claim 38, Gonda et al teaches that a user would have to provide proof that he is 
authorized to initiate a connection [column 1 1, lines 4-21] 

Gonda et al does not teach that the first logic comprises stored values to be used in an 
authentication process during establishment of the network connection. 

Servi teaches a stored password on a requesting node to access protected resources on a 
server node [column 1, lines 55-63], 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to modify Gonda et al so that any of the firewall devices would 
have been authenticated by a stored password to establish a network connection. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Gonda et al by the teaching of Servi because this provides 
a method for reliable identification of a device attempting access to protected resources by a 
remote verifier using reduced communications [column 1, lines 45-47]. 

Conclusion 

15. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Aravind K Moorthy whose telephone number is 571-272-3793. 
The examiner can normally be reached on Monday-Friday, 8:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
Aravind K Moorthy 

November 24, 2004 m ^ 




